Privacy Policy

For the purposes of this Privacy Policy, the following terms have the meanings set out below:

• "Personal Data" means any information relating to an identified or identifiable natural person ("data subject"). An identifiable person is one who can be identified, directly or indirectly, including by reference to an identifier such as a name, identification number, location data, or online identifier.
• "Processing" means any operation performed on Personal Data, whether by automated means or otherwise, including collection, recording, organization, storage, adaptation, retrieval, use, disclosure, transmission, erasure, or destruction.
• "Controller" refers to hmtoto, the entity that determines the purposes and means of processing Personal Data collected through the Platform.
• "Processor" refers to any third party that processes Personal Data on behalf of hmtoto, including payment processors, KYC verification service providers, and cloud infrastructure providers.
• "Data Subject" refers to you — the individual whose Personal Data is being processed.
• "Consent" refers to a freely given, specific, informed, and unambiguous indication of the data subject's agreement to the processing of their Personal Data.
• "KYC" (Know Your Customer) refers to the identity and age verification process conducted by the Company as part of its regulatory compliance obligations.

hmtoto collects the following categories of Personal Data from Members and Platform visitors. The specific data collected depends on how you interact with the Platform:

hmtoto collects Personal Data through the following channels and mechanisms:

3.1 Direct Collection

The majority of your Personal Data is collected directly from you when you:

• Register a Member Account by completing the registration form.
• Submit KYC verification documents in response to an identity verification request.
• Initiate a deposit or withdrawal transaction and provide payment method details.
• Contact the customer support team via live chat, email, or any other support channel.
• Participate in promotions, surveys, or feedback programs offered on the Platform.

3.2 Automated Collection

Certain Technical Data and Usage Data is collected automatically when you access the Platform, through technologies including:

• Server logs that record your IP address, access time, pages requested, and HTTP response codes.
• Cookies and similar tracking technologies (described in detail in Clause 9) that store session information and user preferences.
• Analytics tools that track aggregated user behavior patterns to support Platform performance optimization.
• Fraud detection systems that analyze device fingerprints, behavioral patterns, and transaction metadata.

3.3 Third-Party Sources

In limited circumstances, hmtoto may receive Personal Data about you from third parties, including:

• Identity verification and KYC service providers who return verification results and risk scores based on documents you submit.
• Payment processors who confirm transaction status and flag potential payment fraud.
• Responsible gaming databases that flag individuals who have self-excluded from gaming platforms operated by hmtoto's affiliates.

hmtoto processes your Personal Data only for specified, explicit, and legitimate purposes. The primary purposes are as follows:

• Account Management: To create, maintain, verify, and administer your Member Account, including authenticating your identity at login and enforcing the one-account-per-person policy.
• Service Delivery: To provide access to the wagering services available on the Platform, process your bets, settle your winnings, and maintain accurate records of your transaction history.
• Payment Processing: To facilitate deposits and withdrawals via your chosen payment method (including local Indonesian bank transfers and e-wallet transactions) and to maintain financial records as required by the Company's licensing obligations.
• KYC Compliance: To verify your identity, confirm that you are at least 21 years of age, and satisfy the anti-money laundering (AML) and counter-terrorism financing (CTF) obligations imposed by the Company's international gaming license.
• Fraud Prevention and Security: To detect, investigate, and prevent fraudulent activity, account abuse, collusion, money laundering, and unauthorized access to the Platform.
• Responsible Gaming: To monitor wagering behavior for patterns indicative of problem gambling, to administer deposit limits, cooling-off periods, and self-exclusion requests, and to comply with responsible gaming obligations under the Company's license.
• Customer Support: To respond to your inquiries, resolve disputes, investigate complaints, and deliver effective after-sales service in Indonesian and English.
• Marketing Communications: Where you have provided explicit consent, to send you information about promotions, bonuses, seasonal offers (such as Idul Fitri and Ramadhan promotions), and product updates that may be of interest to you. You may withdraw this consent at any time.
• Platform Improvement: To analyze aggregated, anonymized usage data in order to improve Platform performance, user experience, and game selection.
• Legal and Regulatory Compliance: To comply with any applicable laws, regulations, court orders, or lawful requests from competent authorities in the Company's licensing jurisdiction.

hmtoto processes your Personal Data on one or more of the following legal bases, depending on the specific processing activity involved:

• Contractual Necessity: Processing that is necessary for the performance of the contract between you and hmtoto (i.e., the Terms & Conditions you accepted upon registration). This covers account management, service delivery, and payment processing.
• Legal Obligation: Processing that is required to comply with the Company's legal and regulatory obligations under its international gaming license, including KYC, AML, and CTF obligations.
• Legitimate Interests: Processing carried out in pursuit of the Company's legitimate business interests, provided those interests are not overridden by your fundamental rights and freedoms. This covers fraud detection, Platform security, and aggregated analytics for service improvement.
• Consent: Processing for marketing communication s is based on your explicit, freely given consent. You may withdraw this consent at any time by clicking the unsubscribe link in any marketing email or by contacting support.
• Vital Interests: In rare cases, processing may be necessary to protect your vital interests or those of another person, such as in the event of a medical emergency or a credible threat to safety.

hmtoto does not sell, rent, or trade your Personal Data to third parties for their own marketing purposes. However, the Company may share your Personal Data with the following categories of recipients in order to deliver the Platform's services:

6.1 Service Providers (Processors)

hmtoto engages trusted third-party service providers who process Personal Data on the Company's behalf, under strict contractual data protection obligations. These include:

• Payment Processors: Banks and payment gateways that facilitate deposits and withdrawals via BCA, BRI, BNI, Mandiri, CIMB Niaga, OVO, DANA, GoPay, ShopeePay, and LinkAja.
• KYC/AML Service Providers: Identity verification vendors who validate government-issued ID documents and screen Members against global sanctions lists and self-exclusion databases.
• Cloud Infrastructure Providers: Cloud hosting and storage services that maintain the servers and databases on which the Platform operates.
• Game Content Providers: Third-party game studios (including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Pocket Games Soft) who deliver live casino, slot, and other wagering products integrated into the Platform.
• Customer Support Tools: Live chat, email management, and CRM platforms used by the support team to respond to Member inquiries.

6.2 Legal and Regulatory Authorities

The Company may disclose your Personal Data where required or permitted by law, including:

• In response to a lawful request from a court, regulatory authority, or law enforcement agency in the Company's licensing jurisdiction.
• To comply with anti-money laundering (AML), counter-terrorism financing (CTF), or other financial crime reporting obligations.
• Where disclosure is necessary to enforce the Terms & Conditions, protect the Company's legal rights, or prevent fraud or illegal activity.

6.3 Business Transfers

In the event that hmtoto undergoes a corporate transaction such as a merger, acquisition, asset sale, or liquidation, your Personal Data may be transferred to the acquiring entity as part of the business assets. You will be notified of any such transfer via email and given the opportunity to exercise your data rights before the transfer takes effect.

hmtoto retains your Personal Data only for as long as necessary to fulfill the purposes for which it was collected, or as required by applicable law. Retention periods vary by data category:

• Account and Identity Data: Retained for the duration of your active Member Account, plus 7 years following account closure. This extended retention is mandated by the Company's licensing authority to support AML, audit, and dispute resolution obligations.
• Transaction and Financial Data: Retained for 7 years following the date of the transaction, as required by the Company's financial recordkeeping obligations.
• KYC Verification Documents: Retained for 7 years following the last verification event or account closure, whichever is later.
• Communications Data: Support chat transcripts and email correspondence are retained for 3 years from the date of the communication to support quality assurance and dispute resolution.
• Technical and Usage Data: Anonymized and aggregated analytics data may be retained indefinitely. Personally identifiable session logs are retained for 18 months.
• Marketing Consent Records: Retained for 3 years following consent withdrawal to demonstrate compliance with data protection laws.

At the end of the applicable retention period, Personal Data will be securely deleted or anonymized such that it can no longer be associated with an identifiable individual.

hmtoto employs industry-standard technical and organizational measures to protect your Personal Data against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption: All data transmitted between your device and the Platform is encrypted using 256-bit SSL/TLS protocols. Sensitive data at rest (including KYC documents and financial records) is encrypted using AES-256 encryption.
• Access Controls: Access to Personal Data within the Company is restricted on a strict need-to-know basis and governed by role-based access control (RBAC) policies. All access to production databases is logged and monitored.
• Authentication: Member Accounts are protected by password-based authentication. Members are encouraged to choose strong, unique passwords and to change them periodically.
• Penetration Testing: The Platform undergoes regular third-party security audits and penetration testing to identify and remediate vulnerabilities.
• Employee Training: All hmtoto employees and contractors who handle Personal Data receive mandatory data protection and information security training upon onboarding and annually thereafter.
• Incident Response: The Company maintains a documented data breach response plan. In the event of a confirmed data breach that poses a risk to your rights and freedoms, you will be notified within 72 hours in accordance with applicable data protection regulations.

The hmtoto Platform uses cookies and similar tracking technologies to enhance user experience, maintain session state, and collect analytics data. A cookie is a small text file stored on your device by your web browser.

9.1 Types of Cookies Used

• Strictly Necessary Cookies: Essential for the Platform to function. These include session cookies that maintain your login state and security tokens. These cookies cannot be disabled without breaking core functionality.
• Performance Cookies: Collect anonymized data on how visitors use the Platform, including page views, session duration, and navigation paths. This data is used to improve Platform performance and identify technical issues.
• Functionality Cookies: Remember your preferences, such as language selection, currency display format (IDR), and game filter settings, to deliver a personalized experience across sessions.
• Targeting Cookies: Used to deliver relevant promotional content and measure the effectiveness of marketing campaigns. These cookies are only set with your explicit consent and may be disabled at any time.

9.2 Managing Cookie Preferences

You may configure your browser to reject all cookies or to alert you when a cookie is being set. However, disabling strictly necessary cookies will prevent you from using certain features of the Platform, including the ability to log in to your Member Account. Instructions for managing cookies in popular browsers:

• Google Chrome: Settings → Privacy and security → Cookies and other site data
• Mozilla Firefox: Options → Privacy & Security → Cookies and Site Data
• Safari: Preferences → Privacy → Manage Website Data
• Microsoft Edge: Settings → Privacy, search, and services → Cookies and site permissions

Under applicable data protection laws, you have the following rights with respect to your Personal Data processed by hmtoto:

• Right of Access: You have the right to request confirmation of whether hmtoto is processing your Personal Data and, if so, to obtain a copy of that data along with details of the processing activities.
• Right to Rectification: You have the right to request correction of inaccurate or incomplete Personal Data. You can update most Account information directly through your Account settings.
• Right to Erasure (Right to be Forgotten): You have the right to request deletion of your Personal Data in certain circumstances, such as when it is no longer necessary for the purpose for which it was collected. This right is subject to the Company's legal retention obligations (see Clause 7).
• Right to Restriction of Processing: You have the right to request that hmtoto restrict processing of your Personal Data in certain circumstances, such as while a dispute over the accuracy of the data is being resolved.
• Right to Data Portability: You have the right to receive your Personal Data in a structured, commonly used, and machine-readable format, and to request that it be transmitted directly to another controller where technically feasible.
• Right to Object: You have the right to object to processing of your Personal Data that is based on legitimate interests. If you object, hmtoto will cease processing unless it can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.
• Right to Withdraw Consent: Where processing is based on your consent (e.g., for marketing communications), you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing conducted prior to withdrawal.
• Right to Lodge a Complaint: You have the right to lodge a complaint with the data protection supervisory authority in the Company's licensing jurisdiction if you believe that hmtoto has violated your data protection rights.

To exercise any of these rights, please contact the Company's Data Protection Officer using the contact details provided in Clause 14. The Company will respond to your request within 30 days.

The hmtoto Platform is strictly intended for use by adults aged 21 years and older. The Company does not knowingly collect Personal Data from individuals under the age of 21.

If you are a parent or guardian and you become aware that your child has provided Personal Data to hmtoto without your consent, please contact support immediately. If the Company becomes aware that it has collected Personal Data from a person under 21 years of age, that data will be deleted without undue delay and the associated Account will be permanently closed.

All new Accounts are subject to KYC verification, which includes age verification. Members who fail age verification will have their Accounts immediately suspended, and any funds deposited will be refunded following verification of the payment method ownership.

The hmtoto Platform may contain links to third-party websites, including game provider sites and payment processor portals. This Privacy Policy applies only to Personal Data collected by hmtoto. When you navigate to a third-party site, you are subject to that site's own privacy policy.

hmtoto is not responsible for the privacy practices of third-party websites and services. We encourage you to review the privacy policies of any external site you visit before providing Personal Data to that site.

hmtoto reserves the right to update this Privacy Policy at any time to reflect changes in data processing practices, legal requirements, or business operations. Where material changes are made — meaning changes that substantively expand the scope of data collection, introduce new processing purposes, or alter your data subject rights — the Company will provide at least 30 days' advance notice via email to your registered contact address and via a prominent announcement on the Platform.

The "Last Updated" date at the top of this page reflects the effective date of the most recent substantive revision. Continued use of the Platform following the effective date of an updated Privacy Policy constitutes your acceptance of the revised terms.

If you have any questions, concerns, or requests regarding this Privacy Policy or the processing of your Personal Data, please contact hmtoto's Data Protection Officer (DPO) through any of the following channels: